Skip to content

Commit 2478763

Browse files
imabhichowimabhichow
authored
Option Split (#84)
1 parent a0438fa commit 2478763

File tree

9 files changed

+164
-27
lines changed

9 files changed

+164
-27
lines changed

‎src/main/java/software/amazon/encryption/s3/S3AsyncEncryptionClient.java

Lines changed: 12 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -41,13 +41,15 @@ public class S3AsyncEncryptionClient implements S3AsyncClient {
4141
private final S3AsyncClient _wrappedClient;
4242
private final CryptographicMaterialsManager _cryptoMaterialsManager;
4343
private final SecureRandom _secureRandom;
44+
private final boolean _enableLegacyWrappingAlgorithms;
4445
private final boolean _enableLegacyUnauthenticatedModes;
4546
private final boolean _enableDelayedAuthenticationMode;
4647

4748
private S3AsyncEncryptionClient(Builder builder) {
4849
_wrappedClient = builder._wrappedClient;
4950
_cryptoMaterialsManager = builder._cryptoMaterialsManager;
5051
_secureRandom = builder._secureRandom;
52+
_enableLegacyWrappingAlgorithms = builder._enableLegacyWrappingAlgorithms;
5153
_enableLegacyUnauthenticatedModes = builder._enableLegacyUnauthenticatedModes;
5254
_enableDelayedAuthenticationMode = builder._enableDelayedAuthenticationMode;
5355
}
@@ -80,6 +82,7 @@ public <T> CompletableFuture<T> getObject(GetObjectRequest getObjectRequest,
8082
GetEncryptedObjectPipeline pipeline = GetEncryptedObjectPipeline.builder()
8183
.s3AsyncClient(_wrappedClient)
8284
.cryptoMaterialsManager(_cryptoMaterialsManager)
85+
.enableLegacyWrappingAlgorithms(_enableLegacyWrappingAlgorithms)
8386
.enableLegacyUnauthenticatedModes(_enableLegacyUnauthenticatedModes)
8487
.enableDelayedAuthentication(_enableDelayedAuthenticationMode)
8588
.build();
@@ -132,6 +135,7 @@ public static class Builder {
132135
private SecretKey _aesKey;
133136
private PartialRsaKeyPair _rsaKeyPair;
134137
private String _kmsKeyId;
138+
private boolean _enableLegacyWrappingAlgorithms = false;
135139
private boolean _enableLegacyUnauthenticatedModes = false;
136140
private boolean _enableDelayedAuthenticationMode = false;
137141
private Provider _cryptoProvider = null;
@@ -220,6 +224,11 @@ private boolean onlyOneNonNull(Object... values) {
220224
return haveOneNonNull;
221225
}
222226

227+
public Builder enableLegacyWrappingAlgorithms(boolean shouldEnableLegacyWrappingAlgorithms) {
228+
this._enableLegacyWrappingAlgorithms = shouldEnableLegacyWrappingAlgorithms;
229+
return this;
230+
}
231+
223232
public Builder enableLegacyUnauthenticatedModes(boolean shouldEnableLegacyUnauthenticatedModes) {
224233
this._enableLegacyUnauthenticatedModes = shouldEnableLegacyUnauthenticatedModes;
225234
return this;
@@ -252,19 +261,19 @@ public S3AsyncEncryptionClient build() {
252261
if (_aesKey != null) {
253262
_keyring = AesKeyring.builder()
254263
.wrappingKey(_aesKey)
255-
.enableLegacyUnauthenticatedModes(_enableLegacyUnauthenticatedModes)
264+
.enableLegacyWrappingAlgorithms(_enableLegacyWrappingAlgorithms)
256265
.secureRandom(_secureRandom)
257266
.build();
258267
} else if (_rsaKeyPair != null) {
259268
_keyring = RsaKeyring.builder()
260269
.wrappingKeyPair(_rsaKeyPair)
261-
.enableLegacyUnauthenticatedModes(_enableLegacyUnauthenticatedModes)
270+
.enableLegacyWrappingAlgorithms(_enableLegacyWrappingAlgorithms)
262271
.secureRandom(_secureRandom)
263272
.build();
264273
} else if (_kmsKeyId != null) {
265274
_keyring = KmsKeyring.builder()
266275
.wrappingKeyId(_kmsKeyId)
267-
.enableLegacyUnauthenticatedModes(_enableLegacyUnauthenticatedModes)
276+
.enableLegacyWrappingAlgorithms(_enableLegacyWrappingAlgorithms)
268277
.secureRandom(_secureRandom)
269278
.build();
270279
}

‎src/main/java/software/amazon/encryption/s3/S3EncryptionClient.java

Lines changed: 13 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -76,6 +76,7 @@ public class S3EncryptionClient implements S3Client {
7676
private final S3Client _wrappedClient;
7777
private final CryptographicMaterialsManager _cryptoMaterialsManager;
7878
private final SecureRandom _secureRandom;
79+
private final boolean _enableLegacyWrappingAlgorithms;
7980
private final boolean _enableLegacyUnauthenticatedModes;
8081
private final boolean _enableDelayedAuthenticationMode;
8182
private final boolean _enableMultipartPutObject;
@@ -85,6 +86,7 @@ private S3EncryptionClient(Builder builder) {
8586
_wrappedClient = builder._wrappedClient;
8687
_cryptoMaterialsManager = builder._cryptoMaterialsManager;
8788
_secureRandom = builder._secureRandom;
89+
_enableLegacyWrappingAlgorithms = builder._enableLegacyWrappingAlgorithms;
8890
_enableLegacyUnauthenticatedModes = builder._enableLegacyUnauthenticatedModes;
8991
_enableDelayedAuthenticationMode = builder._enableDelayedAuthenticationMode;
9092
_enableMultipartPutObject = builder._enableMultipartPutObject;
@@ -148,6 +150,7 @@ public <T> T getObject(GetObjectRequest getObjectRequest,
148150
GetEncryptedObjectPipeline pipeline = GetEncryptedObjectPipeline.builder()
149151
.s3Client(_wrappedClient)
150152
.cryptoMaterialsManager(_cryptoMaterialsManager)
153+
.enableLegacyWrappingAlgorithms(_enableLegacyWrappingAlgorithms)
151154
.enableLegacyUnauthenticatedModes(_enableLegacyUnauthenticatedModes)
152155
.enableDelayedAuthentication(_enableDelayedAuthenticationMode)
153156
.build();
@@ -299,11 +302,12 @@ public static class Builder {
299302
private SecretKey _aesKey;
300303
private PartialRsaKeyPair _rsaKeyPair;
301304
private String _kmsKeyId;
302-
private boolean _enableLegacyUnauthenticatedModes = false;
305+
private boolean _enableLegacyWrappingAlgorithms = false;
303306
private boolean _enableDelayedAuthenticationMode = false;
304307
private boolean _enableMultipartPutObject = false;
305308
private Provider _cryptoProvider = null;
306309
private SecureRandom _secureRandom = new SecureRandom();
310+
private boolean _enableLegacyUnauthenticatedModes = false;
307311

308312
private Builder() {
309313
}
@@ -388,6 +392,11 @@ private boolean onlyOneNonNull(Object... values) {
388392
return haveOneNonNull;
389393
}
390394

395+
public Builder enableLegacyWrappingAlgorithms(boolean shouldEnableLegacyWrappingAlgorithms) {
396+
this._enableLegacyWrappingAlgorithms = shouldEnableLegacyWrappingAlgorithms;
397+
return this;
398+
}
399+
391400
public Builder enableLegacyUnauthenticatedModes(boolean shouldEnableLegacyUnauthenticatedModes) {
392401
this._enableLegacyUnauthenticatedModes = shouldEnableLegacyUnauthenticatedModes;
393402
return this;
@@ -425,19 +434,19 @@ public S3EncryptionClient build() {
425434
if (_aesKey != null) {
426435
_keyring = AesKeyring.builder()
427436
.wrappingKey(_aesKey)
428-
.enableLegacyUnauthenticatedModes(_enableLegacyUnauthenticatedModes)
437+
.enableLegacyWrappingAlgorithms(_enableLegacyWrappingAlgorithms)
429438
.secureRandom(_secureRandom)
430439
.build();
431440
} else if (_rsaKeyPair != null) {
432441
_keyring = RsaKeyring.builder()
433442
.wrappingKeyPair(_rsaKeyPair)
434-
.enableLegacyUnauthenticatedModes(_enableLegacyUnauthenticatedModes)
443+
.enableLegacyWrappingAlgorithms(_enableLegacyWrappingAlgorithms)
435444
.secureRandom(_secureRandom)
436445
.build();
437446
} else if (_kmsKeyId != null) {
438447
_keyring = KmsKeyring.builder()
439448
.wrappingKeyId(_kmsKeyId)
440-
.enableLegacyUnauthenticatedModes(_enableLegacyUnauthenticatedModes)
449+
.enableLegacyWrappingAlgorithms(_enableLegacyWrappingAlgorithms)
441450
.secureRandom(_secureRandom)
442451
.build();
443452
}

‎src/main/java/software/amazon/encryption/s3/internal/GetEncryptedObjectPipeline.java

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -43,6 +43,8 @@ public class GetEncryptedObjectPipeline {
4343
private final S3Client _s3Client;
4444
private final S3AsyncClient _s3AsyncClient;
4545
private final CryptographicMaterialsManager _cryptoMaterialsManager;
46+
private final boolean _enableLegacyWrappingAlgorithms;
47+
4648
private final boolean _enableLegacyUnauthenticatedModes;
4749
private final boolean _enableDelayedAuthentication;
4850

@@ -59,6 +61,7 @@ private GetEncryptedObjectPipeline(Builder builder) {
5961
}
6062
this._s3AsyncClient = builder._s3AsyncClient;
6163
this._cryptoMaterialsManager = builder._cryptoMaterialsManager;
64+
this._enableLegacyWrappingAlgorithms = builder._enableLegacyWrappingAlgorithms;
6265
this._enableLegacyUnauthenticatedModes = builder._enableLegacyUnauthenticatedModes;
6366
this._enableDelayedAuthentication = builder._enableDelayedAuthentication;
6467
}
@@ -219,6 +222,7 @@ public static class Builder {
219222
private S3Client _s3Client;
220223
private S3AsyncClient _s3AsyncClient;
221224
private CryptographicMaterialsManager _cryptoMaterialsManager;
225+
private boolean _enableLegacyWrappingAlgorithms;
222226
private boolean _enableLegacyUnauthenticatedModes;
223227
private boolean _enableDelayedAuthentication;
224228

@@ -250,6 +254,11 @@ public Builder cryptoMaterialsManager(CryptographicMaterialsManager cryptoMateri
250254
return this;
251255
}
252256

257+
public Builder enableLegacyWrappingAlgorithms(boolean enableLegacyWrappingAlgorithms) {
258+
this._enableLegacyWrappingAlgorithms = enableLegacyWrappingAlgorithms;
259+
return this;
260+
}
261+
253262
public Builder enableLegacyUnauthenticatedModes(boolean enableLegacyUnauthenticatedModes) {
254263
this._enableLegacyUnauthenticatedModes = enableLegacyUnauthenticatedModes;
255264
return this;

‎src/main/java/software/amazon/encryption/s3/materials/S3Keyring.java

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -21,12 +21,12 @@ abstract public class S3Keyring implements Keyring {
2121

2222
public static final String KEY_PROVIDER_ID = "S3Keyring";
2323

24-
private final boolean _enableLegacyUnauthenticatedModes;
24+
private final boolean _enableLegacyWrappingAlgorithms;
2525
private final SecureRandom _secureRandom;
2626
private final DataKeyGenerator _dataKeyGenerator;
2727

2828
protected S3Keyring(Builder<?,?> builder) {
29-
_enableLegacyUnauthenticatedModes = builder._enableLegacyUnauthenticatedModes;
29+
_enableLegacyWrappingAlgorithms = builder._enableLegacyWrappingAlgorithms;
3030
_secureRandom = builder._secureRandom;
3131
_dataKeyGenerator = builder._dataKeyGenerator;
3232
}
@@ -88,8 +88,8 @@ public DecryptionMaterials onDecrypt(final DecryptionMaterials materials, List<E
8888
throw new S3EncryptionClientException("Unknown key wrap: " + keyProviderInfo);
8989
}
9090

91-
if (decryptStrategy.isLegacy() && !_enableLegacyUnauthenticatedModes) {
92-
throw new S3EncryptionClientException("Enable legacy modes to use legacy key wrap: " + keyProviderInfo);
91+
if (decryptStrategy.isLegacy() && !_enableLegacyWrappingAlgorithms) {
92+
throw new S3EncryptionClientException("Enable legacy wrapping algorithms to use legacy key wrapping algorithm: " + keyProviderInfo);
9393
}
9494

9595
try {
@@ -103,7 +103,7 @@ public DecryptionMaterials onDecrypt(final DecryptionMaterials materials, List<E
103103
abstract protected Map<String,DecryptDataKeyStrategy> decryptStrategies();
104104

105105
abstract public static class Builder<KeyringT extends S3Keyring, BuilderT extends Builder<KeyringT, BuilderT>> {
106-
private boolean _enableLegacyUnauthenticatedModes = false;
106+
private boolean _enableLegacyWrappingAlgorithms = false;
107107
private SecureRandom _secureRandom;
108108
private DataKeyGenerator _dataKeyGenerator = new DefaultDataKeyGenerator();
109109

@@ -112,8 +112,8 @@ protected Builder() {}
112112

113113
protected abstract BuilderT builder();
114114

115-
public BuilderT enableLegacyUnauthenticatedModes(boolean shouldEnableLegacyUnauthenticatedModes) {
116-
this._enableLegacyUnauthenticatedModes = shouldEnableLegacyUnauthenticatedModes;
115+
public BuilderT enableLegacyWrappingAlgorithms(boolean shouldEnableLegacyWrappingAlgorithms) {
116+
this._enableLegacyWrappingAlgorithms = shouldEnableLegacyWrappingAlgorithms;
117117
return builder();
118118
}
119119

‎src/test/java/software/amazon/encryption/s3/S3AsyncEncryptionClientTest.java

Lines changed: 43 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -33,10 +33,12 @@
3333
import java.util.ArrayList;
3434
import java.util.List;
3535
import java.util.concurrent.CompletableFuture;
36+
import java.util.concurrent.CompletionException;
3637

3738
import static org.junit.jupiter.api.Assertions.assertDoesNotThrow;
3839
import static org.junit.jupiter.api.Assertions.assertEquals;
3940
import static org.junit.jupiter.api.Assertions.assertThrows;
41+
import static org.junit.jupiter.api.Assertions.assertTrue;
4042
import static software.amazon.encryption.s3.utils.S3EncryptionClientTestResources.BUCKET;
4143
import static software.amazon.encryption.s3.utils.S3EncryptionClientTestResources.appendTestSuffix;
4244
import static software.amazon.encryption.s3.utils.S3EncryptionClientTestResources.deleteObject;
@@ -100,9 +102,9 @@ public void putDefaultGetAsync() {
100102
final String input = "PutDefaultGetAsync";
101103

102104
v3Client.putObject(builder -> builder
103-
.bucket(BUCKET)
104-
.key(objectKey)
105-
.build(), RequestBody.fromString(input));
105+
.bucket(BUCKET)
106+
.key(objectKey)
107+
.build(), RequestBody.fromString(input));
106108

107109
CompletableFuture<ResponseBytes<GetObjectResponse>> futureGet = v3AsyncClient.getObject(builder -> builder
108110
.bucket(BUCKET)
@@ -139,6 +141,7 @@ public void aesCbcV1toV3Async() {
139141
// V3 Client
140142
S3AsyncClient v3Client = S3AsyncEncryptionClient.builder()
141143
.aesKey(AES_KEY)
144+
.enableLegacyWrappingAlgorithms(true)
142145
.enableLegacyUnauthenticatedModes(true)
143146
.build();
144147

@@ -154,6 +157,43 @@ public void aesCbcV1toV3Async() {
154157
v3Client.close();
155158
}
156159

160+
@Test
161+
public void failAesCbcV1toV3AsyncWhenDisabled() {
162+
final String objectKey = appendTestSuffix("fail-aes-cbc-v1-to-v3-async-when-disabled");
163+
164+
// V1 Client
165+
EncryptionMaterialsProvider materialsProvider =
166+
new StaticEncryptionMaterialsProvider(new EncryptionMaterials(AES_KEY));
167+
CryptoConfiguration v1CryptoConfig =
168+
new CryptoConfiguration();
169+
AmazonS3Encryption v1Client = AmazonS3EncryptionClient.encryptionBuilder()
170+
.withCryptoConfiguration(v1CryptoConfig)
171+
.withEncryptionMaterials(materialsProvider)
172+
.build();
173+
174+
final String input = "0bcdefghijklmnopqrst0BCDEFGHIJKLMNOPQRST";
175+
176+
v1Client.putObject(BUCKET, objectKey, input);
177+
178+
// V3 Client
179+
S3AsyncClient v3Client = S3AsyncEncryptionClient.builder()
180+
.aesKey(AES_KEY)
181+
.enableLegacyWrappingAlgorithms(true)
182+
.build();
183+
try {
184+
CompletableFuture<ResponseBytes<GetObjectResponse>> futureResponse = v3Client.getObject(builder -> builder
185+
.bucket(BUCKET)
186+
.key(objectKey), AsyncResponseTransformer.toBytes());
187+
futureResponse.join();
188+
} catch (CompletionException e) {
189+
assertEquals(S3EncryptionClientException.class, e.getCause().getClass());
190+
}
191+
192+
// Cleanup
193+
deleteObject(BUCKET, objectKey, v3Client);
194+
v3Client.close();
195+
}
196+
157197
@Test
158198
public void AsyncAesGcmV2toV3WithInstructionFile() {
159199
final String objectKey = appendTestSuffix("async-aes-gcm-v2-to-v3-with-instruction-file");

0 commit comments

Comments
 (0)